Differential Privacy (DP)

The epsilon (ε) parameter is the definitive metric of privacy loss. A lower ε value enforces a stronger guarantee by constraining the statistical distance between outputs computed on datasets that differ by a single record.

• ε = 0.1: Extremely strong privacy, high noise
• ε = 1.0: Standard strong guarantee
• ε = 10: Weaker guarantee, higher utility

The budget is consumed cumulatively across all queries or training rounds. Once exhausted, no further analysis is permitted on that dataset, preventing privacy erosion over time.

DP operates by adding carefully calibrated statistical noise—typically drawn from a Laplace or Gaussian distribution—to query outputs or model gradients. The noise scale is proportional to the sensitivity of the function (the maximum impact any single record can have).

• Laplace Mechanism: Optimal for scalar queries with L1 sensitivity
• Gaussian Mechanism: Preferred for vector-valued outputs and gradient perturbation
• Exponential Mechanism: Used for non-numeric outputs where a utility score ranks candidates

This ensures that the presence or absence of any individual patient's scan cannot be reliably detected from the model's behavior.

The core semantic guarantee of DP is plausible deniability: an adversary observing the output of a DP-protected computation cannot confidently determine whether any specific individual's data was included in the input.

Formally, for any two neighboring datasets differing by one record, the probability ratio of producing any given output is bounded by e^ε. This holds even against adversaries with:

• Unlimited auxiliary information about all other records
• Complete knowledge of the algorithm's mechanics
• Arbitrary computational power

This is a worst-case guarantee, not an average-case heuristic.

DP provides formal rules for how privacy loss accumulates across multiple analyses, enabling systematic budget management in complex federated pipelines.

• Sequential Composition: Running k DP mechanisms on the same data consumes kε total budget
• Parallel Composition: Running mechanisms on disjoint data subsets consumes only max(ε) budget
• Post-Processing Immunity: Any computation applied to a DP output cannot weaken the guarantee—no additional budget is consumed

These properties allow CTOs to architect multi-round federated training with provable end-to-end privacy accounting.

DP-SGD is the workhorse algorithm for training deep learning models with differential privacy. It modifies standard SGD through two operations at each training step:

1. Gradient Clipping: Individual per-example gradients are clipped to a maximum L2 norm (C) to bound sensitivity
2. Noise Addition: Gaussian noise scaled to C and the privacy parameters (ε, δ) is added to the averaged, clipped gradients

The moments accountant tracks privacy loss across iterations with high precision, providing tight (ε, δ) bounds for the entire training run. This is the standard approach for privacy-preserving diagnostic model training.

DP can be deployed in two distinct trust models, each relevant to different healthcare federation topologies:

Central DP (Trusted Curator)

• A trusted server collects raw data and applies DP to query responses
• Enables higher utility at a given ε
• Requires institutional trust in the aggregator

Local DP (LDP)

• Noise is applied by each client before data leaves the device
• No trusted third party required
• Higher noise levels needed for equivalent privacy
• Used when hospitals demand zero raw data exposure

The epsilon (ε) parameter quantifies the privacy loss bound in a DP mechanism. A lower epsilon enforces a stronger guarantee by limiting how much any single individual's data can influence an output.

• ε < 1: Strong privacy, high noise, reduced utility
• 1 < ε < 10: Moderate privacy, balanced utility
• ε > 10: Weak privacy, minimal noise

Each query or training round consumes a portion of the total budget. Once exhausted, no further analysis on that dataset is permitted without risking privacy leakage. This is formalized through composition theorems that track cumulative privacy loss across multiple operations.

An adversarial technique where an attacker analyzes a trained model's parameters, gradients, or outputs to reconstruct sensitive training data.

• Gradient leakage: Reconstructing input images from shared gradients in federated learning
• Membership inference: Determining if a specific record was in the training set
• Attribute inference: Extracting sensitive attributes about training subjects

Differential privacy provides a provable defense against these attacks by bounding the influence of any single training example, making reconstruction mathematically infeasible below a certain confidence threshold.

A cryptographic scheme enabling computation directly on encrypted data without decryption. The result, when decrypted, matches operations performed on plaintext.

• Partially HE: Supports only addition or multiplication
• Somewhat HE: Supports limited operations before noise overwhelms signal
• Fully HE (FHE): Supports arbitrary computation on ciphertexts

HE and DP serve complementary roles: HE protects data in transit and computation, while DP protects against what can be inferred from outputs. Combined, they create end-to-end privacy-preserving ML pipelines.

A communication efficiency technique that reduces the size of transmitted model updates before sending to the aggregation server.

• Quantization: Reducing gradient precision from 32-bit floats to 8-bit integers or fewer
• Sparsification: Transmitting only the top-k gradient values, zeroing out the rest
• Low-rank approximation: Decomposing gradient matrices into smaller factors

Gradient compression interacts with DP: the randomized rounding used in stochastic quantization can itself provide a form of privacy amplification, and compressed gradients reduce the attack surface for gradient leakage.

Aggregation rules designed to defend the global model against Byzantine failures or malicious data poisoning from compromised client nodes.

• Krum: Selects the gradient vector closest to its neighbors, ignoring outliers
• Trimmed Mean: Discards extreme values per coordinate before averaging
• Median: Uses coordinate-wise median instead of mean

These techniques complement DP by addressing integrity threats (poisoning) while DP addresses confidentiality threats (inference). Together they provide a comprehensive security posture for federated diagnostic networks.